How to stop a hitbot ? - GoFuckYourself.com

DarkJedi · 01-04-2003, 10:19 AM

One of my sites gets 1k an hour of no ref hits. Its not a cheater, someone just wants to fuck up my site. These hits don't click anywhere.

How the fuck do i stop it ?

Jakke PNG · 01-04-2003, 10:34 AM

I think it's a sitesucker.. just block all of those fuckers in your htaccess and see if the norefs slow down. If you've already done that, disregard this.

mongoose403 · 01-04-2003, 10:34 AM

is the ip the same?

DarkJedi · 01-04-2003, 10:42 AM

no the IPs are different - i entered them to .htaccess but it doenst help much

deny from 205.188.208.103
deny from 64.12.96.11
deny from 198.81.26.137
deny from 66.131.66.251
deny from 24.159.40.28
deny from 211.28.96.68
deny from 195.93.34.9
deny from 211.22.33.9
deny from 195.93.50.9
deny from 200.52.160.2
deny from 68.84.9.150
deny from 208.5.238.167
deny from 68.54.8.118
deny from 195.92.168.168
deny from 68.15.50.22
deny from 219.97.35.155
deny from 62.155.204.24
deny from 62.252.128.10
deny from 24.116.65.69
deny from 64.201.192.220
deny from 24.197.0.6
deny from 203.220.107.190
deny from 64.230.97.92
deny from 217.231.17.118
deny from 195.92.67.65
deny from 4.62.115.56
deny from 156.34.213.233
deny from 66.169.3.21
deny from 68.104.26.218
deny from 152.163.188.69
deny from 24.202.241.145
deny from 61.94.203.158
deny from 61.211.130.19
deny from 217.231.17.118
deny from 198.81.26.137
deny from 24.52.212.36
deny from 24.197.0.6
deny from 61.170.224.53
deny from 64.152.169.50
deny from 67.33.176.17
deny from 24.208.79.113
deny from 68.102.90.139
deny from 65.30.198.37
deny from 67.36.177.120
deny from 194.117.133.180
deny from 66.57.188.185
deny from 65.113.238.33
deny from 24.80.82.57
deny from 202.188.67.9
deny from 145.53.35.115

DarkJedi · 01-04-2003, 10:43 AM

TGF whats a sitesucker ?

SykkBoy · 01-04-2003, 10:56 AM

**cue fanfare**

Va2k · 01-04-2003, 11:43 AM

Hey Dark did you ever fig it out mate? I need to get something like that as well for my tgp site everything i have tried make the page not load

TOM

Undutchable · 01-04-2003, 11:45 AM

A site sucker is a program that will leech your entire site.. Teleport Pro does this for instance

They're usually used to download content without having to view the ads on the HTML

Jakke PNG · 01-04-2003, 11:46 AM

Quote:

Originally posted by DarkJedi
TGF whats a sitesucker ?

A program that downloads your pics and shit. Sorta offline browser.
like Download Ninja 7.0 etc.

Speedy26 · 01-04-2003, 12:31 PM

here is a list to get you started, if anyone has an updated list please share.

goes into your .htaccess file if you dont know what your doing have your server admin add it..

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*WebZIP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Iria.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Stripper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Offline.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Copier.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Crawler.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Snagger.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Teleport.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Reaper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Grabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Sucker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Downloader.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Siphon.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Collector.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Mag-Net.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Widow.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pockey.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*DA.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Snake.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*BackWeb.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*gotit.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Vacuum.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SmartDownload.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pump.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*HMView.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Ninja.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*HTTrack.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JOC.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*likse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Memo.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*pcBrowser.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SuperBot.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*leech.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Mirror.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Recorder.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*GrabNet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Likse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Navroad.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*attach.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Magnet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Surfbot.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Bandit.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Ants.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Buddy.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Whacker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*DISCoPump.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Drip.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*EirGrabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ExtractorPro.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*EyeNetIE.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*FlashGet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*GetRight.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Gets.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go!Zilla.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go-Ahead-Got-It.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Grafula.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*IBrowse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*InterGET.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*InternetNinja.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JetCar.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JustView.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*MIDownool.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*MisterPiX.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*NearSite.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*NetSpider.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*OfflineExplorer.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PageGrabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PapaFoto.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pockey.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ReGet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Slurp.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SpaceBison.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SuperHTTP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Teleport.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebAuto.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebCopier.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebFetch.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebReaper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebSauger.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebStripper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebWhacker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebZIP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebImageCollector.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebSucker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Webster.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*eCatch.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ia_archiver.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*lftp.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*tAkeOut.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*FileHound.*$
RewriteRule /*$ http://www.redirectURLhere [L,R]

vegasdude · 01-04-2003, 12:34 PM

click on the button stop or disable... it depends on the hitbot

jamie55 · 01-25-2003, 05:45 AM

Just a Q, I have a cronjob on my site which uses wget. But when I paste the code above into my .htaccess, the wget function gets redirected too ...

How can I stop this ?

Thanks!

DarkJedi · 01-25-2003, 05:56 AM

va2k - i haven't figured it out yet. I still get 20k of hitbots a day.

speedy26 - that thing will slow down the server.

421Fill · 01-25-2003, 06:03 AM

Quote:

Originally posted by DarkJedi
va2k - i haven't figured it out yet. I still get 20k of hitbots a day.

speedy26 - that thing will slow down the server.

htaccess slows down the server and or page? you sure?

digital · 01-25-2003, 07:55 AM

put a hidden link somewhere on your page to a script that will save the IP accessing it and than deny it in your .htaccess,
have in mind that a lot of IPs in your .htaccess will slow down
your web server, so find a way to ban them in your traffic trade script.

digital

Gals4free · 07-01-2003, 12:58 PM

Digging up an old thread i know... but i have a similar prob to this... and only after two days of ip banning (had over 400 ips banned) i posted on another board and someone notified me of those websuckers programs. So now i put that whole htaccess thing in there.. but still it continues @ 6-10k hits per hour.

Does anyone have an updated list? or is there any other thing that could be causing it? As its been going on for three days.. and i cant stop it.

Steve

Steve · 07-01-2003, 01:12 PM

new versions of UCJ have IP banning features - so if an IP hits your page too much, it winds up getting banned (I think the default ban is 2 hours) - UCJ basically auto-updates the htaccess file.

Gals4free · 07-01-2003, 01:18 PM

Im using TM3.. so unfortunately i cant use that feature. My next site will be on UCJ.. so good to know about that feature

jimmyf · 07-01-2003, 01:19 PM

can tell you what I did on one of my sites, and they quit after they found out they were getting htm's instead of .jpg's.

PowerCum · 07-01-2003, 01:25 PM

Try this filter, It's completely PHP written

http://tgp.icefire.org/filter.php.txt

If you want to see my configuration... then hit this:
http://tgp.icefire.org/filter.php?dump

Hope this helps you something

easyfun · 07-01-2003, 01:59 PM

Quote:

Try this filter, It's completely PHP written

http://tgp.icefire.org/filter.php.txt

If you want to see my configuration... then hit this:
http://tgp.icefire.org/filter.php?dump

Hope this helps you something

Nice script you have there -
Most hit botters play and soon leave after doing a bit of screwing up - This thread is about more permanent bots - The bastards that never go away -
I currently have bots on about 12 sites - Constantly, even though I have removed all traffic scripts - The c-u-n-t behind it wants to make sure I do not use scripts again - However - He has now fucked himself as we have traced via proxies to his original ip -

I am only running one script now - I started using it last week and sure enough, as soon as I did the bots increased -
So I used htaccess to block it -
I have three guys working shifts sitting and watching the site's activity and as a new ip comes in it is watched over - If the ip becomes over-active, it is blocked right away -
Today saw a new turn up - As proxies were being made useless - We had regular ips hitting hard - We didn't see it right away - But as we are always cross checking trades, we did find it in reasonably good time and was able to get this fixed.
We had Eskoemen go in tonight and he found three ips which we had missed - But these had caused no damage -
If you have read any of my posts - I do not need to say which SUNNY fucking Polish brainless, gutless brotherfucking C_U_N_T is behind this -

Gals4free · 07-01-2003, 02:08 PM

That does indeed look like a good script, but how would i implement this? Im not an expert with php nor htaccess

extreme · 07-01-2003, 02:09 PM

[linux root prompt]# iptables -A INPUT -s [OFFENDING IP] -j DROP

FATPad · 07-01-2003, 02:12 PM

Quote:

Originally posted by Speedy26

RewriteCond %{HTTP_USER_AGENT} ^.*Slurp.*$ [OR]
[/url] [L,R]

I thought Slurp was the Inktomi spider?

cezam · 07-01-2003, 02:24 PM

Quote:

Originally posted by jamie55
Just a Q, I have a cronjob on my site which uses wget. But when I paste the code above into my .htaccess, the wget function gets redirected too ...

Just remove this line: RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR]

swedguy · 07-01-2003, 02:37 PM

I just checked the top 4 and all of them were AOL proxies.
Probably not a very good idea to block them

205.188.208.103
64.12.96.11
198.81.26.137
66.131.66.251

Vox · 07-01-2003, 04:17 PM

Quote:

Originally posted by Gals4free
That does indeed look like a good script, but how would i implement this? Im not an expert with php nor htaccess

I'm guessing you add this to the top of the page:

The page you put this on would have to end with an extension like .shtml or .php

PHP Code:


			
<!--#include file="filter.php" -->

But I could be wrong, so can anyone confirm this?

Rui · 07-01-2003, 04:30 PM

Quote:

Originally posted by PowerCum
Try this filter, It's completely PHP written

http://tgp.icefire.org/filter.php.txt

If you want to see my configuration... then hit this:
http://tgp.icefire.org/filter.php?dump

Hope this helps you something

´

thanks alot!

Do you know how could I change the script above it to redirect to diferent pages based on the language?

once again cheers

Gals4free · 07-02-2003, 06:35 AM

Could anyone Confirm what vox said? So i know how to stop this websucker. I am getting 10k hits per hour of it.. So its a big pain in the ass. Unfortunately im not that good with php/htaccess and all that.

So some clear explenation on how to implement this please

Steve

PowerCum · 07-02-2003, 06:54 AM

Quote:

Originally posted by Rui
´

thanks alot!

Do you know how could I change the script above it to redirect to diferent pages based on the language?

once again cheers

I am working on the geotargeted version that will add automatically hitbots to the filter based on activity patterns. As always, it will be free

It will be done for day 15.

If you really need this feature very urgent you can use the $_SERVER["HTTP_ACCEPT_LANGUAGE"] variable.
Unfortunately some browsers (like the mine) accept several languages or do not really have a standard (MSIE 6.0 and Netscape 7.x), so the only way to get the real location is geotargeting.

Rui · 07-02-2003, 07:31 AM

Quote:

Originally posted by PowerCum

I am working on the geotargeted version that will add automatically hitbots to the filter based on activity patterns. As always, it will be free

It will be done for day 15.

If you really need this feature very urgent you can use the $_SERVER["HTTP_ACCEPT_LANGUAGE"] variable.
Unfortunately some browsers (like the mine) accept several languages or do not really have a standard (MSIE 6.0 and Netscape 7.x), so the only way to get the real location is geotargeting.

Rui · 07-19-2003, 08:00 AM

any news regarding this?

megaporn · 07-19-2003, 08:13 AM

if those ip are anonymous proxies maybe someone is trying dictionary attack using some kind of soft for example AccessDiver

candyflip · 07-19-2003, 08:27 AM

Quote:

Originally posted by Rui
any news regarding this?

I'm not sure if he's released the code seperately, but he did make it available as part of the new version of CJOverkill.

FATPad · 07-19-2003, 08:29 AM

Quote:

Originally posted by FATPad
I thought Slurp was the Inktomi spider?

Guess I'll repeat this.

I thought Slurp was the Inktomi spider?

DamageX · 07-19-2003, 09:36 AM

Quote:

Originally posted by FATPad
Guess I'll repeat this.

I thought Slurp was the Inktomi spider?

Slurp is the Inktomi spider.

rowan · 07-19-2003, 10:43 AM

Using htaccess to eat up outbound clicks with no cookie presented will defeat most of the site suckers. However, it will also defeat legitimate spiders.

*** WARNING: THIS IS UNTESTED ***

RewriteEngine on
RewriteCond %{HTTP_COOKIE} !^.*ttt_cookie.*$
RewriteRule .*ttt-out.php.*$ /nocookies.html

If a surfer loads ttt-out.php and does not present the cookie 'ttt_cookie' (which is normally set when they load the main page), they will be redirected to /nocookies.html

FATPad · 07-19-2003, 11:17 AM

Quote:

Originally posted by DamageX

Slurp is the Inktomi spider.

Thank you.

OzKaNoz · 07-19-2003, 12:23 PM

Great info guys.

Oz

DamageX · 07-20-2003, 01:01 PM

Quote:

Originally posted by FATPad
Thank you.

You're welcome.

goBigtime · 07-20-2003, 01:44 PM

How to blackhole IP's at the server level:

Generic (should work on any unix OS)
/sbin/route add IP 333.444.555.666

Generic Linux
/sbin/route add -host IP gw 333.444.555.666

Newer versions of Linux support the reject flag now. (I believe kernel 2.2+)
For linux users, try this one first...if it tells you reject is not a valid flag, use the generic one.
/sbin/route add -host IP reject

Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD)
/sbin/route add IP 333.444.555.666

Generic Sun
/usr/sbin/route add IP 333.444.555.666 1

NEXTSTEP
/usr/etc/route add IP 127.0.0.1 1

FreeBSD
route add -net IP -netmask 255.255.255.255 127.0.0.1 -blackhole

Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX)
/sbin/route add -host -blackhole IP 127.0.0.1

where "IP" is replaced with the IP you want to block.

(courtesy of the iprotect docs)

01-04-2003, 10:19 AM	#1
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	How to stop a hitbot ? One of my sites gets 1k an hour of no ref hits. Its not a cheater, someone just wants to fuck up my site. These hits don't click anywhere. How the fuck do i stop it ?

01-04-2003, 10:34 AM	#2
Jakke PNG ex-TeenGodFather Industry Role: Join Date: Nov 2001 Location: Suomi Finland Perkele Posts: 20,306	I think it's a sitesucker.. just block all of those fuckers in your htaccess and see if the norefs slow down. If you've already done that, disregard this. __________________ ..and I'm off.

01-04-2003, 10:34 AM	#3
mongoose403 Confirmed User Join Date: Oct 2002 Location: wild ho country Posts: 143	is the ip the same? __________________ .

01-04-2003, 10:56 AM	#6
SykkBoy Jesus loves bacon Industry Role: Join Date: Feb 2001 Location: Sin City, Motherfucker Posts: 19,969	cue fanfare __________________ Support my new movie “The Second Coming”

01-04-2003, 11:43 AM	#7
Va2k I’m still alive barley. Industry Role: Join Date: Oct 2001 Location: Va Posts: 10,060	Hey Dark did you ever fig it out mate? I need to get something like that as well for my tgp site everything i have tried make the page not load TOM __________________

01-04-2003, 10:42 AM	#4
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	no the IPs are different - i entered them to .htaccess but it doenst help much deny from 205.188.208.103 deny from 64.12.96.11 deny from 198.81.26.137 deny from 66.131.66.251 deny from 24.159.40.28 deny from 211.28.96.68 deny from 195.93.34.9 deny from 211.22.33.9 deny from 195.93.50.9 deny from 200.52.160.2 deny from 68.84.9.150 deny from 208.5.238.167 deny from 68.54.8.118 deny from 195.92.168.168 deny from 68.15.50.22 deny from 219.97.35.155 deny from 62.155.204.24 deny from 62.252.128.10 deny from 24.116.65.69 deny from 64.201.192.220 deny from 24.197.0.6 deny from 203.220.107.190 deny from 64.230.97.92 deny from 217.231.17.118 deny from 195.92.67.65 deny from 4.62.115.56 deny from 156.34.213.233 deny from 66.169.3.21 deny from 68.104.26.218 deny from 152.163.188.69 deny from 24.202.241.145 deny from 61.94.203.158 deny from 61.211.130.19 deny from 217.231.17.118 deny from 198.81.26.137 deny from 24.52.212.36 deny from 24.197.0.6 deny from 61.170.224.53 deny from 64.152.169.50 deny from 67.33.176.17 deny from 24.208.79.113 deny from 68.102.90.139 deny from 65.30.198.37 deny from 67.36.177.120 deny from 194.117.133.180 deny from 66.57.188.185 deny from 65.113.238.33 deny from 24.80.82.57 deny from 202.188.67.9 deny from 145.53.35.115

01-04-2003, 10:43 AM	#5
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	TGF whats a sitesucker ?

01-04-2003, 11:45 AM	#8
Undutchable Registered User Industry Role: Join Date: Jun 2002 Posts: 2,217	A site sucker is a program that will leech your entire site.. Teleport Pro does this for instance They're usually used to download content without having to view the ads on the HTML

01-04-2003, 12:31 PM	#10
Speedy26 Confirmed User Join Date: Apr 2001 Location: MI Posts: 950	here is a list to get you started, if anyone has an updated list please share. goes into your .htaccess file if you dont know what your doing have your server admin add it.. RewriteEngine On RewriteCond %{HTTP_USER_AGENT} ^.WebZIP.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Iria.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Stripper.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Offline.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Copier.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Crawler.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Snagger.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Teleport.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Reaper.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Wget.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Grabber.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Sucker.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Downloader.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Siphon.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Collector.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Mag-Net.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Widow.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Pockey.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.DA.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Snake.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.BackWeb.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.gotit.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Vacuum.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.SmartDownload.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Pump.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.HMView.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Ninja.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.HTTrack.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.JOC.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.likse.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Memo.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.pcBrowser.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.SuperBot.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.leech.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Mirror.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Recorder.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.GrabNet.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Likse.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Navroad.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.attach.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Magnet.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Surfbot.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Bandit.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Ants.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Buddy.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Whacker.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.DISCoPump.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Drip.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.EirGrabber.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.ExtractorPro.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.EyeNetIE.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.FlashGet.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.GetRight.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Gets.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Go!Zilla.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Go-Ahead-Got-It.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Grafula.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.IBrowse.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.InterGET.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.InternetNinja.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.JetCar.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.JustView.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.MIDownool.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.MisterPiX.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.NearSite.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.NetSpider.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.OfflineExplorer.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.PageGrabber.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.PapaFoto.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Pockey.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.ReGet.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Slurp.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.SpaceBison.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.SuperHTTP.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Teleport.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebAuto.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebCopier.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebFetch.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebReaper.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebSauger.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebStripper.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebWhacker.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebZIP.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebImageCollector.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.WebSucker.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Webster.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.Wget.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.eCatch.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.ia_archiver.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.lftp.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.tAkeOut.$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.FileHound.$ RewriteRule /*$ http://www.redirectURLhere [L,R] __________________ http://www.amberscash.com webmaster {at} crazynakedchick [dot] com

01-04-2003, 12:34 PM	#11
vegasdude Confirmed User Join Date: Jul 2001 Location: The Royal Family Crew Posts: 3,649	click on the button stop or disable... it depends on the hitbot __________________ Did you fucking talk to me??! Who the fuck told you to talk to me??!"

01-25-2003, 05:45 AM	#12
jamie55 Registered User Join Date: Sep 2002 Posts: 50	Just a Q, I have a cronjob on my site which uses wget. But when I paste the code above into my .htaccess, the wget function gets redirected too ... How can I stop this ? Thanks!

01-25-2003, 05:56 AM	#13
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	va2k - i haven't figured it out yet. I still get 20k of hitbots a day. speedy26 - that thing will slow down the server.

01-25-2003, 07:55 AM	#15
digital Confirmed User Join Date: Apr 2002 Location: Digital Underground Posts: 125	put a hidden link somewhere on your page to a script that will save the IP accessing it and than deny it in your .htaccess, have in mind that a lot of IPs in your .htaccess will slow down your web server, so find a way to ban them in your traffic trade script. digital

07-01-2003, 12:58 PM	#16
Gals4free Confirmed User Join Date: Apr 2003 Posts: 428	Digging up an old thread i know... but i have a similar prob to this... and only after two days of ip banning (had over 400 ips banned) i posted on another board and someone notified me of those websuckers programs. So now i put that whole htaccess thing in there.. but still it continues @ 6-10k hits per hour. Does anyone have an updated list? or is there any other thing that could be causing it? As its been going on for three days.. and i cant stop it. Steve

07-01-2003, 01:12 PM	#17
Steve Confirmed User Join Date: Feb 2001 Location: USA Posts: 6,894	new versions of UCJ have IP banning features - so if an IP hits your page too much, it winds up getting banned (I think the default ban is 2 hours) - UCJ basically auto-updates the htaccess file.

07-01-2003, 01:18 PM	#18
Gals4free Confirmed User Join Date: Apr 2003 Posts: 428	Im using TM3.. so unfortunately i cant use that feature. My next site will be on UCJ.. so good to know about that feature

07-01-2003, 01:19 PM	#19
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	can tell you what I did on one of my sites, and they quit after they found out they were getting htm's instead of .jpg's. __________________ Epic CashEpic Cash works for me Solar Cash Paysite Plugin Gallery of the day freesites,POTD,Gallery generator with free hosting

07-01-2003, 01:25 PM	#20
PowerCum CjOverkill Industry Role: Join Date: Apr 2003 Location: Woldwide Posts: 1,328	Try this filter, It's completely PHP written http://tgp.icefire.org/filter.php.txt If you want to see my configuration... then hit this: http://tgp.icefire.org/filter.php?dump Hope this helps you something __________________ CjOverkill Traffic Trading Script Free, secure and fast traffic trading script. Get your copy now

07-01-2003, 02:08 PM	#22
Gals4free Confirmed User Join Date: Apr 2003 Posts: 428	That does indeed look like a good script, but how would i implement this? Im not an expert with php nor htaccess

07-01-2003, 02:09 PM	#23
extreme Confirmed User Industry Role: Join Date: Oct 2002 Location: lalaland Posts: 2,120	[linux root prompt]# iptables -A INPUT -s [OFFENDING IP] -j DROP __________________ Browse and find new paysites with screenshot-preview Export FHGs/FLVs/Paysites by JSON, XML, CSV and Text Find FHGs/FLVs/Paysites from any given Category or Search-query

07-01-2003, 02:37 PM	#26
swedguy Confirmed User Industry Role: Join Date: Jan 2002 Posts: 7,981	I just checked the top 4 and all of them were AOL proxies. Probably not a very good idea to block them 205.188.208.103 64.12.96.11 198.81.26.137 66.131.66.251

07-02-2003, 06:35 AM	#29
Gals4free Confirmed User Join Date: Apr 2003 Posts: 428	Could anyone Confirm what vox said? So i know how to stop this websucker. I am getting 10k hits per hour of it.. So its a big pain in the ass. Unfortunately im not that good with php/htaccess and all that. So some clear explenation on how to implement this please Steve

07-19-2003, 08:00 AM	#32
Rui web Join Date: Dec 2001 Location: On icq: 85-483-060 Posts: 9,533	any news regarding this?

07-19-2003, 08:13 AM	#33
megaporn Confirmed User Join Date: Nov 2002 Location: top of the world Posts: 255	if those ip are anonymous proxies maybe someone is trying dictionary attack using some kind of soft for example AccessDiver __________________ <a href="http://www.soulcash.com/referral=rev9502/index.html" target="_top">Soul Cash</a> 35 $ per join, hosted pics and videos.<br> <a href="http://www.revsharehosting.com/9502" target="_top">Free Adult Hosting (PHP, MySQL, CGI, Perl)</a> no banners or pop-ups!

07-19-2003, 10:43 AM	#37
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	Using htaccess to eat up outbound clicks with no cookie presented will defeat most of the site suckers. However, it will also defeat legitimate spiders. * WARNING: THIS IS UNTESTED * RewriteEngine on RewriteCond %{HTTP_COOKIE} !^.ttt_cookie.$ RewriteRule .ttt-out.php.$ /nocookies.html If a surfer loads ttt-out.php and does not present the cookie 'ttt_cookie' (which is normally set when they load the main page), they will be redirected to /nocookies.html

07-19-2003, 12:23 PM	#39
OzKaNoz Confirmed User Join Date: Jan 2001 Location: Deep With In Your Mind Posts: 1,834	Great info guys. Oz __________________ Techie Media Web Hosting

07-20-2003, 01:44 PM	#41
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	How to blackhole IP's at the server level: Generic (should work on any unix OS) /sbin/route add IP 333.444.555.666 Generic Linux /sbin/route add -host IP gw 333.444.555.666 Newer versions of Linux support the reject flag now. (I believe kernel 2.2+) For linux users, try this one first...if it tells you reject is not a valid flag, use the generic one. /sbin/route add -host IP reject Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) /sbin/route add IP 333.444.555.666 Generic Sun /usr/sbin/route add IP 333.444.555.666 1 NEXTSTEP /usr/etc/route add IP 127.0.0.1 1 FreeBSD route add -net IP -netmask 255.255.255.255 127.0.0.1 -blackhole Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) /sbin/route add -host -blackhole IP 127.0.0.1 where "IP" is replaced with the IP you want to block. (courtesy of the iprotect docs) Last edited by goBigtime; 07-20-2003 at 01:50 PM..